General discussion

Locked

Porn Pics on Server. Need to Know More

By Nom@d ·
I have been asked to find out about some Adult material found on our Server and somebody's Workstation.
Is it possible to know when the pictures and videos were first put onto the system and last accessed or viewed?
Does it make a difference to the dating of the pictures / videos if they are transfered from an old server to a new one?
If the pictures have been opened during the investigation does this complicate things?

Thanks
John

This conversation is currently closed to new comments.

4 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by softcorp.us In reply to Porn Pics on Server. Need ...

Hello John...

Q: Is it possible to know when the pictures and videos were first put onto the system and last accessed or viewed?
A: It depends on how the file was created. Sometimes the file create date will be the date on that system. Sometimes it will be the date from a previous create on another system. For example, when you use Windows Explorer to copy a file, the create and accessed dates are updated but the modified date is not. When some other methods are used, perhaps none of the dates are changed.

Q: Does it make a difference to the dating of the pictures / videos if they are transfered from an old server to a new one?
A: Same answer as above.

Q: If the pictures have been opened during the investigation does this complicate things?
A: Yes due to the explanation above.

I'm sure I could offer some better answers if you would send me a copy of...

...just kidding...

-----Steve

Collapse -

by softcorp.us In reply to

Revision to the third Q&A:

Q: If the pictures have been opened during the investigation does this complicate things?
A: The accessed date will be modified whenever a file is opened, including during your investigation. The create and modify date should not be changed.

Collapse -

by tlath1972 In reply to Porn Pics on Server. Need ...

when you look at the files it should tell you when they were created. with the folder open click view at the top and click on details. This should give you when it was created. The create date won't change if you opend them

Collapse -

by Stubby In reply to Porn Pics on Server. Need ...

John,

Firstly I'd turn the investigation over to a specialist third party - if its legal (top shelf) porn then the police won't be interested, however folks like Vogon or Ontrack can and do forensic investigations for you.

They have clearly defined methodologies when dealing with these incidents and can take a forensic snapshot for safe keeping to preserve the chain of evidence.

Unfortunately, without a lot more info to go on thna has been given most of the answers you'll receive will be along the lines of ... maybe.

You need to establish with, I guess, your managers, what they are hoping to achieve. If it is just a slap on the hand and then a tightening of the defences, then carry on as you are. If they want it to lead to a "proper" investigation and formal warning, then I strongly suggest you contact one of the forensic companies suggested above - or any of the 100's of others around. Last thing your employers want is the hand they are trying to bite turning round and biting them for wrongful dismissal or harassment.

Back to Networks Forum
4 total posts (Page 1 of 1)  

Related Discussions

Related Forums